> ## Documentation Index > Fetch the complete documentation index at: https://docs-stg.outerlayer.ai/llms.txt > Use this file to discover all available pages before exploring further. # Roles and permissions > What the Owner, Admin, Write and Read roles can do, and how custom roles and factory access change a member's access. Every member of an organization has one role. The role sets what the member can see and change. This page lists what each built-in role can do. It also covers custom roles, factory access and the audit log. To give a member a role, see [Invite your team](https://docs-stg.outerlayer.ai/invite-your-team.md). To change one, see [Manage members](https://docs-stg.outerlayer.ai/invite-your-team.md#manage-members). ## The built-in roles Each role can do everything the role to its left can do. | | Read | Write | Admin | Owner | | - | - | - | - | - | | View the Work page, checks, evidence, sessions, metrics and hosts | Yes | Yes | Yes | Yes | | Add work and request a build | No | Yes | Yes | Yes | | Record a review: pass or fail an item or a criterion | No | Yes | Yes | Yes | | File and edit specs | No | Yes | Yes | Yes | | Connect an issue tracker and change its settings | No | Yes | Yes | Yes | | Create and view factory API keys | No | Yes | Yes | Yes | | Merge a pull request from the item page | No | No | Yes | Yes | | Withdraw work that another member added | No | No | Yes | Yes | | Disconnect an issue tracker | No | No | Yes | Yes | | Edit and revoke factory API keys | No | No | Yes | Yes | | Connect, reconfigure and disconnect a repository | No | No | Yes | Yes | | Create, edit and delete factories | No | No | Yes | Yes | | View, set and remove a factory's control plane | No | No | Yes | Yes | | Edit organization settings | No | No | Yes | Yes | | Invite members, change roles and remove members | No | No | Yes | Yes | | Create, edit and delete custom roles | No | No | Yes | Yes | | Configure single sign-on | No | No | Yes | Yes | | View the audit log | No | No | Yes | Yes | | Create and revoke management API keys | No | No | Yes | Yes | | View billing | No | No | Yes | Yes | | Subscribe, switch the billing interval, update the card and cancel | No | No | No | Yes | | Delete the single sign-on configuration | No | No | No | Yes | | Make a member an owner | No | No | No | Yes | Every plan includes custom roles, factory access and single sign-on. The audit log and management API keys need an Enterprise plan. See [Plans and limits](https://docs-stg.outerlayer.ai/billing-and-trials.md#plans-and-limits). You cannot remove the last owner of an organization. Every active member is billed, whatever their role. See [Billed members](https://docs-stg.outerlayer.ai/billing-and-trials.md#billed-members). ### The Disabled role A member with the Disabled role has no access and is not billed. The role menus in the dashboard do not offer it. You set it with the [Organization API](https://docs-stg.outerlayer.ai/organization-api.md#members-and-roles). To give a disabled member a role again, open **Organization settings → Members**. Then choose **Re-enable** in the member's menu. ## Custom roles A custom role is a named set of permissions that you choose. Use one when no built-in role fits. Owners and admins create custom roles. A custom role can hold only permissions that you hold yourself. To create a custom role: 1. Open the account menu at the bottom left, then choose **Organization settings → Roles**. 2. Choose **Create a role**. 3. Enter a **Role name**. Use letters, numbers and dashes, up to 100 characters. 4. Enter a description of up to 500 characters in **Description (optional)**, or leave it empty. 5. Select the permissions the role needs. When a permission requires another one, the form selects that one too. 6. Choose **Create role**. The role then appears under **Custom roles** in the role menus of the invite dialog and the change-role dialog. To change a role, choose **Edit role** on its row, then **Save changes**. The change applies to every member who holds the role. To delete a role, choose **Delete role** and type the role's name. If members hold the role, choose the role they get instead. The dialog warns you when that role gives permissions that the deleted role did not. ## Factory access A member holds their organization role on every factory. You can limit a member to the factories you choose, and give them a different role on each. 1. Open the account menu at the bottom left, then choose **Organization settings → Members**. 2. Choose the menu at the end of the member's row, then **Manage factory access**. 3. Turn on **Restrict to specific factories**. 4. Turn on each factory the member needs. 5. Choose the member's role on each factory: Read, Write, Admin or a custom role. Each change saves as you make it. The invite dialog has the same **Restrict to specific factories** switch. These rules apply: * A factory role replaces the member's organization role on that factory. It does not add to it. * A restricted member sees only the factories you turn on. With none turned on, the member has no factory access. * An owner keeps the Owner role on every factory. You cannot restrict an owner. * Actions on the organization, such as inviting members, still follow the organization role. To remove the limit, turn **Restrict to specific factories** off and choose **Remove restriction**. The member then holds the organization role on every factory again. ## Audit log The audit log records changes to access. These include invites, role changes, changes to factory access, API key changes and refused attempts. Nobody can edit or delete an entry. The audit log needs an Enterprise plan. The audit log also records each change to an automation, built in or custom. It records these events: * A member or an API key adds, changes or deletes an automation. * A member turns an automation on or off. * A member starts a run with **Run now**. * A member chooses **File again** for a topic. An entry for a change holds the settings before the change and the settings after it. An entry for a deleted automation keeps its name. The audit log does not record a change that leaves every setting as it was. It does not record what OuterLayer does by itself, such as a switch-off after failed runs. It does not record a run that a schedule starts. It never holds a signing secret. Open **Organization settings → Audit log** to filter the entries by action and target, or choose **Export CSV**. To read the log from a script, see [Audit log](https://docs-stg.outerlayer.ai/organization-api.md#audit-log) in the Organization API. ## Next steps * [Invite your team](https://docs-stg.outerlayer.ai/invite-your-team.md) to give members a role. * [Set up single sign-on](https://docs-stg.outerlayer.ai/single-sign-on.md) so members sign in with your identity provider. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.